WhatsApp contact lookup let researchers list 3.5 billion accounts

What happened

Researchers at SBA Research found that WhatsApp's contact discovery feature had no limit on how many phone numbers could be checked. Probing more than 100 million numbers an hour, they confirmed over 3.5 billion active accounts in 245 countries.

The study did not access any message content.

What was found

The lookups returned phone numbers, public keys and timestamps, along with public profile photos for 56.7% of accounts and About text for 29.3%. Meta added rate limiting and stricter visibility rules in October 2025 and says it found no sign of abuse; the researchers deleted the data they collected.

Data at risk

• Phone numbers
• Public keys
• Profile photos
• About text
• Timestamps

What you should do

1. 1No update is needed on your phone; Meta fixed this on its servers.
2. 2In WhatsApp's privacy settings, limit who can see your profile photo and About text.